Finland

The Act's administrative-fine mechanism, its main operative duty, reaches a provider, authorized representative, importer, distributor, or deployer of an AI system rather than a government body: Section 24 bars a fine against every named category of Finnish public authority. The Act supplements the EU AI Act within its Article 2 scope, but does not apply to the work of Parliament, the Parliamentary Ombudsman, or the Chancellor of Justice.

Section 6 designates Traficom (Transport- och kommunikationsverket) as the common contact point under AI Act Article 70, responsible for coordinating the authorities competent under this Act and, together with the other market surveillance authorities, for the annual reporting to the European Commission under AI Act Article 99(11). Sections 3, 4, and 5 split market surveillance of high-risk AI systems, prohibited practices, and transparency obligations among named sectoral authorities.

Section 13 creates a Sanctions Board (Påföljdsavgiftsnämnden) that decides an administrative fine under Sections 14 to 22 against a provider, authorized representative, importer, distributor, deployer, or notified body for breaching a duty under the AI Act.

Section 24 bars a fine against state authorities, state enterprises, municipal authorities, welfare regions, independent public-law institutions, parliamentary agencies, the Office of the President of the Republic, and the Evangelical Lutheran and Orthodox Churches in Finland and their parishes, against anyone already facing prosecution or a final conviction for the same act, and more than five years after the violation.

Government proposal HE 220/2026 vp would amend Section 3(1)(4) of the Act, on the occupational safety authority acting as a market surveillance authority for certain high-risk AI systems, to replace its references to the existing occupational safety supervision act and technical devices act with a reference to the proposed Act on the conformity of technical devices intended for use at work. The proposal describes the change to Section 3(1)(4) as technical. The proposed laws are intended to take effect on 20 January 2027.

Section 19 bans manufacturing, offering, or otherwise distributing an image depicting a child sexually where the image is based on an actual situation involving a real child, or where the image is realistic, meaning it deceptively resembles a photograph of a situation in which a child is depicted sexually even though no real child was involved, by a fine or imprisonment for at most two years; because the realistic-depiction branch asks whether the image deceptively resembles a photograph, not how it was made, a wholly AI-generated or synthetically altered image can fall within it.

Section 20 raises the penalty to imprisonment for at least four months and at most six years for an aggravated case, including where the depicted child is especially young or the image also shows serious violence against the child. Section 21 separately punishes possessing such an image, or paying or otherwise arranging access to it, by a fine or imprisonment for at most two years.

A narrow exception in Section 19 excuses production or distribution that is justified by the image's informational character or its evident artistic value.

A controller must notify the Data Protection Ombudsman without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Finland, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. The Data Protection Act adds no separate national breach notification regime.

An employer may not require an employee to take part in genetic testing when hiring or during the employment, and has no right to find out whether a genetic test has been done on an employee. An employer may carry out continuous camera surveillance in premises it uses to ensure the personal safety of employees and others, protect property, monitor the proper operation of production processes, or prevent or investigate situations that endanger safety, property or production.

Camera surveillance may not be used to monitor a particular employee or particular employees at the workplace. There may be no camera surveillance in toilets, changing rooms or similar places, other staff facilities, or rooms assigned to employees' personal use.

An employer may target camera surveillance at a particular workstation only where necessary to prevent obvious threats of violence or danger, to prevent and solve property crime where handling valuable property is an essential part of the employee's duties, or at the request of the employee to be monitored.

Before introducing camera surveillance the employer must examine less intrusive means, must not intrude on employee privacy more than necessary, may use recordings only for the purposes of the surveillance, must inform employees after the cooperation or consultation procedure, and must announce the surveillance visibly in the premises where cameras are placed.

Recordings must be destroyed as soon as they are no longer needed for the purpose of the surveillance and at the latest one year after the recording ends. Sections 16 and 17 were last amended by Act 347 of 2019, in force from 1 April 2019.

The Data Protection Act specifies and supplements the General Data Protection Regulation (GDPR) within the GDPR's own scope of application. Section 5 sets the digital age of consent for information society services at 13, the lower bound GDPR Article 8 permits.

Section 24 assigns GDPR Article 83 administrative fines to a collegial Sanctions Board made up of the Data Protection Ombudsman and at least two Deputy Ombudsmen, with a three-member quorum, rather than to a single official, and bars a fine against central government and several other public bodies.

Section 27 disapplies specified GDPR articles for processing performed solely for journalistic, academic, artistic or literary purposes, including Chapter V transfer rules where applying them would infringe freedom of expression.

Transferring personal data of a person in Finland outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.

Section 27 disapplies Articles 44 to 50 for processing performed solely for journalistic, academic, artistic or literary purposes where applying them would infringe freedom of expression or information; outside that narrow exemption the Act does not broaden or narrow Chapter V.

General Data Protection Regulation (GDPR) Article 22 gives a person in Finland the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

The Data Protection Act adds no rule of its own on automated decisions.

General Data Protection Regulation (GDPR) Articles 12 to 21 apply in Finland. Data Protection Act Section 33 restricts the Article 13/14 information duty, and Section 34 restricts the Article 15 access right, on national security, defence, public order, offence prevention, or tax and public finance supervisory grounds; Section 34 also allows access to be refused where it would seriously endanger the person's health or care or the rights of the person or another.

Section 21 gives a right to refer a complaint to the Data Protection Ombudsman, with a three-month handling deadline and a right of appeal to an administrative court if that deadline is missed.

The Data Protection Ombudsman is Finland's supervisory authority. Section 24 assigns a General Data Protection Regulation (GDPR) Article 83 administrative fine to a collegial Sanctions Board chaired by the Ombudsman with at least two Deputy Ombudsmen and a three-member quorum, carries a ten-year limitation period from the infringement, and bars a fine against central government authorities, municipal authorities, and several other named public bodies.

GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor, and court proceedings to claim it are brought before the courts competent under Finnish law.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category.

Data Protection Act Section 6, read in full, lifts the Article 9(1) bar in eight named contexts (an insurer assessing or determining its liability, processing provided for by law or necessary for a public-interest task that the law gives the controller, trade union membership for employment law, healthcare and social welfare delivery, anti-doping and disability sports, and research, statistics or archiving); none of the eight names biometric data, and the section carries no illustrative list or enumeration of biometric identifier types.

Biometric data processed for unique identification is therefore governed directly by GDPR Article 9 itself, with no Finland-specific narrowing or widening of the definition.

Section 8 punishes unlawfully hacking into a computer system where data is processed, stored, or transmitted electronically, or into a separately protected part of such a system, by using an access code that does not belong to the offender or by otherwise breaking a protective measure, and separately punishes obtaining data from such a system without hacking into it, by a special technical device or by other technical means that bypass a protective arrangement, exploit a vulnerability or are otherwise clearly fraudulent, both as a computer break-in (tietomurto) punishable by a fine or imprisonment for at most two years; the section applies only where a more severe penalty is not provided elsewhere.

Section 8a raises the penalty to a fine or imprisonment for at most three years for an aggravated computer break-in, committed as part of an organized criminal group or in a particularly methodical manner, where the offense is also aggravated when assessed as a whole.

Section 13b(1) lets a person with lawful access to a work reproduce it for text-and-data-mining purposes and retain the copies solely for that purpose, unless the author has expressly and appropriately reserved that right.

Section 13b(2) gives research organizations and cultural heritage institutions with lawful access a broader exception to reproduce a work for text-and-data-mining in scientific research and retain the copies for that research, including later verification of research results, provided the copies are accessible only to those entitled to them; that broader exception cannot be overridden by contract or prevented by technical means.

Section 49 gives the maker of a list, table, program, or other work combining a large quantity of information, or a database whose content required substantial investment to gather, verify, or present, the exclusive right to control the whole of its content, or a qualitatively or quantitatively substantial part of it, by reproducing it and making it available to the public.

The right lasts until 15 years have passed from the year the work was completed, or, if the work was made available to the public before that period ended, 15 years from the year it was first made available. A contract term that prevents or restricts a lawful user of a published work from using a qualitatively or quantitatively insubstantial part of its content for any purpose is void.

The Laki eräiden tuotteiden kyberkestävyydestä sekä kyberturvallisuussertifioinnista (439/2026), known colloquially as the Kyberkestävyyslaki, specifies and supplements the directly applicable Cyber Resilience Act (Regulation (EU) 2024/2847) and its national application, rather than restating the Regulation's own essential cybersecurity requirements, which are documented at the European Union level and are not repeated here.

Section 7 leaves a manufacturer's duty to report an actively exploited vulnerability or a severe security-affecting incident entirely to Article 14 of the Regulation, adding only that the computer security incident response team (CSIRT) unit's duty to notify the market surveillance authority of a reported event is set by the Regulation's Article 16(3); Section 8 lets a manufacturer or other party voluntarily report a vulnerability, cyberthreat, incident or near miss to the CSIRT unit under Article 15, and information reported this way cannot be used against the reporter in a criminal investigation or an administrative decision without consent.

Section 15 names Liikenne- ja viestintävirasto (Traficom) as the Regulation's Article 52 market surveillance authority, except that Section 16 assigns a high-risk AI system within the Regulation's scope to the market surveillance authority the Act on the Supervision of Certain Artificial Intelligence Systems designates instead.

Chapter 6 sets Finland's own administrative penalty amounts within the bands Regulation Article 64 allows a Member State to set (Section 38): up to EUR 15,000,000 or 2.5 percent of worldwide turnover for a manufacturer's breach of any duty Section 31(1) lists, which covers the Article 13 essential cybersecurity requirements and support duties, the technical documentation, conformity assessment and CE marking duties, and the Article 14 reporting duties; up to EUR 10,000,000 or 2 percent for a person other than the manufacturer who answers for a manufacturer's duty under Regulation Article 21 or 22 (Section 31(2)), for an authorised representative's, importer's, distributor's or notified body's own obligations (Sections 32 to 35), and for an economic operator's failure to provide information on request, misuse of the CE marking or refusal of access under Section 36(1) to (3); up to EUR 5,000,000 or 1 percent for supplying incorrect, incomplete or misleading information to a notified body or the market surveillance authority (Section 36(4)); and a flat EUR 100,000 cap for a cybersecurity-certification breach (Section 37).

Finland's Act entered into force on 1 June 2026, but Section 45 delays parts of it: Chapter 3 and Section 35 apply from 11 June 2026, Sections 7 to 9 and Section 31(1) items 23 to 26 from 11 September 2026, the date the Regulation's Article 14 reporting duty starts, and Sections 4 to 6, Section 31(1) items 1 to 22, Sections 32 to 34 and Section 36 from 11 December 2027.

An information system or wellbeing application used to process client data in social and health care must meet the essential requirements on interoperability, information security and data protection, and functionality (section 84).

A Class A system or application, which covers the national information system services, systems meant to connect to them, systems certified by their purpose and intermediary services, must show its conformity by certification, which includes the certificate of an information-security assessment body, and the provider is responsible for the certification (sections 79 and 85).

A Class A system or application may be put into production use only after it has been certified, and not if the certificate of its information-security assessment has expired (section 81). The information-security assessment is made on the application of the system service provider or the wellbeing application manufacturer (section 87). The certificate is valid for at most three years and can be extended by up to three years at a time (section 87).

The Licensing and Supervisory Authority (Lupa- ja valvontavirasto) supervises and promotes the conformity of information systems and wellbeing applications and may inspect without prior notice (section 89). Its decisions under the Act can be backed by a conditional fine (section 96). The Act took effect on 1 January 2024 and repealed the earlier Act 784/2021 on the electronic processing of client data (section 101).

Sections 7 to 10 of the Kyberturvallisuuslaki require an entity within scope to identify, assess and manage the risks to the network and information systems it uses in its operations or to provide its services, and to act to prevent or minimise an incident's impact on its operations, their continuity, the recipients of its services and other services (Section 7).

The entity must maintain a documented cybersecurity risk-management operating model (Section 8) whose management measures cover, at minimum, the twelve areas Section 9 lists: risk-management policy and effectiveness assessment; network and information system security policy; security in acquisition, development and maintenance, including vulnerability handling and disclosure; supply-chain security, covering the quality and resilience of direct suppliers' products and services and their cybersecurity practices; asset management and identification of security-critical functions; personnel security and cybersecurity training; access-control and authentication procedures; cryptography policy and, where needed, measures for secured electronic communication; incident detection and handling; backup, recovery planning, crisis management and business continuity; basic information-security practices; and security of the physical environment and premises and of essential resources (Section 9).

The entity's board, supervisory board or chief executive is responsible for organising the implementation and oversight of this risk management, approves the operating model, and must hold sufficient familiarity with cybersecurity risk management (Section 10).

Liikenne- ja viestintävirasto (Traficom) is the supervisory authority for Annex I items 1 to 7, covering transport, space ground infrastructure, digital infrastructure and ICT service management, and for Annex II items 1 to 5, covering postal and courier services, digital service providers (including the online marketplace, online search engine and online social-networking-platform providers flagged here), motor-vehicle and other transport-equipment manufacturing, and research organizations that pursue applied research for commercial use; the Act designates six further sector authorities for its other Annex I and II classes, and a seventh from 1 January 2027.

An intentional or grossly negligent failure of the Section 7, 8 or 9 duties is subject to an administrative penalty of up to EUR 10,000,000 or 2 percent of worldwide annual turnover for an essential entity and up to EUR 7,000,000 or 1.4 percent for any other bound entity (Section 38), mirroring NIS2 Article 34(4) and (5), though Section 35 exempts state authorities, state enterprises, wellbeing regions and joint authorities, municipal authorities, independent public-law institutions, parliamentary agencies, the Office of the President, and the Evangelical Lutheran and Orthodox Churches of Finland and their parishes from the penalty itself, without exempting them from the underlying duty.

Beyond the entities that meet or exceed the medium-enterprise thresholds of Commission Recommendation 2003/361/EC while carrying out an Annex I or Annex II activity, Section 3 binds a narrower set of entities regardless of size: a provider of public electronic communications networks or publicly available electronic communications services, a trust service provider, a top-level-domain registry operator, a DNS service provider, and a critical entity designated outside the public administration sector under the Act on Protecting and Improving the Resilience of Critical Infrastructure (310/2025).

Section 1 excludes the public administration sector named in NIS2 Annex I point 10 from this Act's own scope, assigning that sector instead to the Act on Information Management in Public Administration (906/2019), a different Finnish instrument.

Finanssivalvonta, the Finnish Financial Supervisory Authority, acts as the competent authority under Article 46 of the DORA Regulation (Regulation (EU) 2022/2554) (section 50 a, item 18). A third party that is an ICT third-party service provider under DORA Article 3(19) is another participant in the financial markets under the Act (section 5, item 42). Failing or breaching the ICT risk-management duty in DORA Article 16 is a ground for an administrative fee (rikemaksu) (section 38).

Breach by a financial entity of DORA's duties on ICT risk management (Articles 5 to 14), ICT-related incident management, classification and reporting (Articles 17 to 19), resilience testing (Articles 24 to 27) and third-party ICT risk (Articles 28 to 30) is a ground for a penalty payment (seuraamusmaksu) (section 40).

Finanssivalvonta may pass information on ICT-related disruptions and threats to the Finnish Transport and Communications Agency for their cooperation on managing ICT-related disruptions (sections 3 f and 71). The DORA provisions were added by Act 610/2024, in force from 17 January 2025.

Chapter 21 a applies to domain names other than those ending in the Finnish or Åland country-code domains, and to a top-level domain registry operator and a domain name registrar whose main establishment or designated EU representative is in Finland (section 172 a).

A registrar must notify the Finnish Transport and Communications Agency of its name, contact details, EU establishments, IP address ranges and the Member States where it offers services, and report changes within two weeks, or within three months for establishment details (section 172 b).

A registry operator and a registrar must collect and maintain domain registration data, including the data NIS 2 Directive Article 28(2) lists, keep policies and procedures that ensure the database is accurate and correct, and make those policies public (section 172 c).

They must publish the registration data that is not personal data without undue delay after registration, give access to the other data on a lawful and duly reasoned request within 72 hours of receiving it, and publish their disclosure policies (section 172 d). The chapter was added by Act 442/2026, in force from 1 June 2026, with three months from that date to make the section 172 b notification and to publish the section 172 c and 172 d policies.

Sections 11 to 14 of the Kyberturvallisuuslaki require a bound entity to notify its supervisory authority without delay of a significant incident, defined as one that has caused or could cause a serious service disruption or considerable financial loss to the entity, or that has affected or could affect another natural or legal person with considerable material or immaterial damage.

An early notification is due within 24 hours of detecting the significant incident and a follow-up notification within 72 hours of detection, both clocks running from the moment of detection rather than from each other (Section 11). A trust service provider whose trust services are affected must instead file its follow-up notification within 24 hours rather than 72 (Section 11).

An interim report is due on the supervisory authority's request, or within one month of the follow-up notification if the incident is long-running (Section 12), and a final report is due within one month of the follow-up notification, or within one month of the incident's resolution if it is still ongoing at that point, describing the incident, its likely root cause, mitigation measures taken and any cross-border effects (Section 13).

Where a significant incident is likely to adversely affect an entity's service, or a significant cyberthreat may affect the recipients of that service, the entity must notify them without delay of the incident, the threat, and available countermeasures (Section 14).

Separately, Section 22 makes the Act's computer security incident response team (CSIRT) unit, not the affected manufacturer or provider, the NIS2 Article 12 coordinator for coordinated vulnerability disclosure: it receives reports of vulnerabilities, which may be submitted anonymously, and handles the necessary follow-up. The same penalty bands and exemptions described on this jurisdiction's companion risk-management row apply to a failure of the Section 11, 12 or 13 reporting duties.

A service provider or pharmacy that detects significant deviations in how an information system meets the essential requirements must notify the information system service provider (section 90).

Where a deviation in an information system or wellbeing application may cause a significant risk to client or patient safety or to information security, a service provider, pharmacy, information system service provider or manufacturer, wellbeing application manufacturer, the Social Insurance Institution (Kela) or the Finnish Institute for Health and Welfare must notify the Licensing and Supervisory Authority (Lupa- ja valvontavirasto) (section 90).

A pharmacy must also notify the Finnish Medicines Agency (Lääkealan turvallisuus- ja kehittämiskeskus) where a deviation in an information system may cause a significant risk to the pharmacy's operations (section 90).

A service provider, pharmacy, the Social Insurance Institution and an information system service provider, information system manufacturer or intermediary must notify the Licensing and Supervisory Authority without delay of a significant information-security disturbance in the operating environments and networks they use that may significantly endanger the use of information systems and the provision of social and health care services (section 90).

The Licensing and Supervisory Authority may issue more detailed regulations on when a disturbance is significant and on the content, form and delivery of the notification (section 90). A pharmacy must also notify the Finnish Medicines Agency without delay of a significant information-security disturbance in the operating environments and networks it uses that may significantly endanger the pharmacy's operations (section 90).

Where notification of a deviation or disturbance is in the public interest, the Licensing and Supervisory Authority may require the notifying party to inform the public or, after hearing the party, inform the public itself (section 90). Section 90 leaves the notification of personal data breaches to the Data Protection Ombudsman to Article 33 of the General Data Protection Regulation. The Act, including section 90, took effect on 1 January 2024.

A telecommunications operator (teleyritys) must tell its subscribers and users without delay when a significant information-security breach, or another event that prevents the communications service from working or materially disturbs it, affects or threatens its service (section 274).

A value-added service provider (lisäarvopalvelun tarjoaja) must tell its users without delay of a significant information-security breach, or the threat of one, affecting its service, and the notice from either must state the expected duration of the disturbance and the protective measures open to subscribers and users, and keep a record of its notices (section 274).

Section 275 requires a telecommunications operator to notify the Finnish Transport and Communications Agency (Liikenne- ja viestintävirasto, Traficom) without delay of the same kind of breach or event, and to report without undue delay the estimated duration and effects of the disturbance, the corrective measures taken and the measures taken to prevent it recurring.

The Agency supervises compliance with the Act and with the provisions and decisions issued under it, unless the Act provides otherwise (section 303). A person who intentionally fails the notification duty in section 275(1) is liable to a fine for an electronic communications data-protection offence, unless the failure is minor (section 349).

Section 200, paragraph 1 of the Information Society Code allows direct marketing by automated calling systems, fax machines, e-mail, text messages, voice messages, sound messages or image messages to be directed only at natural persons who have consented to it in advance. Section 200 allows direct marketing to a natural person by other means unless the person has expressly prohibited it, and requires that a natural person can prohibit it easily and free of charge.

Section 200 lets a service provider or seller that obtained a customer's contact details for e-mail, text, voice, sound or image messages in the sale of a product or service use them to market its own products and services of the same product group or otherwise corresponding, if the customer can prohibit that use easily and without separate charge when the details are collected and with every message, and is clearly told of that possibility.

Section 202 allows direct marketing to a community unless it has expressly prohibited it, requires that the community can easily and without separate charge prohibit the use of its contact details with every marketing e-mail, text, voice, sound or image message, and requires the sender to tell it clearly of that possibility.

Section 203 requires an e-mail, text, voice, sound or image message intended for direct marketing under sections 200 and 202 to be clearly and unambiguously recognizable as marketing when received, and prohibits sending one that conceals the identity of the sender on whose behalf it is sent, has no valid address for a request to stop the communication, or tries to steer recipients to websites that breach Chapter 2 of the Consumer Protection Act.

Section 305 gives the Data Protection Ombudsman the task of supervising compliance with sections 200 and 202 to 204. Section 349 punishes a person who intentionally engages in direct marketing in breach of sections 200 to 203 with a fine, unless a more severe penalty is provided elsewhere, and imposes no penalty for a minor breach.

Section 335 a refers the penalty payment for a breach of sections 200 and 201 and of section 203, paragraph 2 to the Act on certain powers of the consumer protection authorities (566/2020).

Section 205, paragraph 1 of the Information Society Code allows a service provider to store cookies or other data describing the use of the service on the user's terminal device, and to use that data, if the user has consented and the provider gives the user understandable and comprehensive information on the purpose of the storing or use.

Section 205, paragraph 2 provides that paragraph 1 does not cover storing or use whose only purpose is to carry out the transmission of a message in communications networks, or that is necessary for the service provider to offer a service the subscriber or user has expressly requested. Section 205, paragraph 3 allows that storing and use only to the extent the service requires and only so far as it restricts privacy no more than is necessary.

Section 303 gives the Finnish Transport and Communications Agency the task of supervising compliance with the Act, unless the Act provides otherwise. Section 349 punishes a person who intentionally fails the duties in section 205, paragraph 1 to ask for consent and give information, or stores or uses data in breach of section 205, with a fine, unless a more severe penalty is provided elsewhere, and imposes no penalty for a minor breach.

Section 37 of the Act on the Protection of Persons Reporting Infringements of European Union and National Law (1171/2022) allows an oral report to be recorded with the reporter's consent. Section 37 requires minutes of a report made at a personal meeting, and the reporter must be given an opportunity to check and approve the minutes. Section 37 requires received reports to be entered in a case management register or otherwise registered.

Section 40 provides that an internal reporting channel must be introduced within three months of the Act entering into force.

Section 5 of Chapter 24 of the Criminal Code punishes whoever, without right, uses a technical device to listen to or record a conversation, speech or other sound arising from private life that is not meant for their knowledge and that occurs in a place protected by domestic peace, or secretly listens to or records speech not meant for them or any other outsider in circumstances where the speaker has no reason to assume an outsider hears it, with a fine or imprisonment of up to one year.

Chapter 24 of the Criminal Code was amended in its present form by Act 531/2000. Act 531/2000 entered into force on 1 October 2000.

Section 3 of Chapter 38 of the Criminal Code punishes whoever, without right, opens a letter or other closed message addressed to another, breaks a protection to obtain information from an electronically stored message protected from outsiders, or obtains information on the content of a call, telegram, text, image or data transmission being transmitted in a telecommunications network or information system, or on its sending or receipt, with a fine or imprisonment of up to two years.

Section 4 of Chapter 38 punishes an aggravated violation, committed by abusing a position with a telecommunications company or another special position of trust, by using software or a special technical device designed or adapted for the offence or otherwise acting with special planning, or involving a message of especially confidential content, with imprisonment of up to three years. Section 3 of Chapter 38 was last amended by Act 368/2015. Act 368/2015 entered into force on 4 September 2015.

Section 201, paragraph 1 of the Information Society Code prohibits marketing a mobile network telephone subscription to a consumer by telephone other than at the consumer's express request. Section 201, paragraph 2 provides that the ban does not apply to a telecommunications company's marketing to its own mobile telephone customers.

Section 349 punishes a person who intentionally markets a telephone subscription in breach of sections 200 to 203 with a fine, unless a more severe penalty is provided elsewhere, and imposes no penalty for a minor breach. Section 335 a refers the penalty payment for a breach of sections 200 and 201 and of section 203, paragraph 2 to the Act on certain powers of the consumer protection authorities (566/2020).

Section 3 of the Freedom of Expression in Mass Media Act applies only Sections 17 to 20 and 22 to activity that consists solely of the technical production, sending, transmission or distribution of a publication or online message.

Section 17 lets the court order the keeper of a transmitter, server or other device to hand over the identifying data needed to identify the sender of an online message, on the demand of an official entitled to arrest, a prosecutor or the injured party, if there is probable cause to suspect that making the message public is punishable. Section 17 lets the court back the disclosure duty with a conditional fine.

Section 18 lets the court, on the application of a prosecutor, an investigation leader or the injured party, order the publisher or the keeper of a transmitter, server or other device to suspend the distribution of a published online message if its content makes it evident that keeping it available is punishable.

Section 18 makes the suspension order lapse unless, within three months of the order, charges for an offence based on the message, a forfeiture claim under Section 22 or an action for damages are brought. Section 22 lets the court order an online message found unlawful in content to be removed from public availability and destroyed. Section 25 brought the Act into force on 1 January 2004.

Section 185 of the Electronic Communications Services Act lets the district court, on the application of a prosecutor, an investigation leader or the person whose right is concerned, order a hosting service provider, on pain of a fine, to block access to information it stores, if the information is manifestly such that keeping it available or transmitting it is punishable or a ground for liability in damages.

Section 185 requires the application to be handled urgently and bars granting it without giving the provider and the content producer a chance to be heard, unless the urgency of the matter prevents a hearing. Section 185 allows the order to be directed at a telecommunications undertaking that relays the information if the hosting service provider cannot be identified or is outside Finnish jurisdiction and the information is evidently an offence punishable by at least two years of imprisonment.

Section 185 makes the order lapse unless charges for an offence based on the information, or, for liability in damages, an action, are brought within three months of the order. Section 185 lets the hosting service provider, the content producer and the telecommunications undertaking apply to the same court to revoke the order within 14 days of learning of it.

Section 186 sends the application to the district court of the domicile of the hosting service provider or telecommunications undertaking, or to the Helsinki District Court. Act 20/2024 repealed Sections 182 to 184, 184 a and 187 to 194 of the Act and rewrote Sections 185 and 186, with effect from 17 February 2024.

Section 1 makes the Finnish Transport and Communications Agency (Liikenne- ja viestintävirasto, Traficom) the digital services coordinator under Article 49 of Regulation (EU) 2022/2065 and the competent authority for its supervision, except as Sections 2, 2 a and 3 provide.

Section 2 makes the Consumer Ombudsman the competent authority for Article 25 where an online platform serves a consumer, Article 26(1)(a) to (c) for advertising from a trader to a consumer, Article 26(2), Article 30(7) and Article 32 of the Regulation. Section 2 a makes the National Audit Office the competent authority for Article 26(1)(a) to (c) where the advertising is ideological or societal.

Section 3 makes the Data Protection Ombudsman the competent authority for Article 26(1)(d), Article 26(3), and Articles 27 and 28 of the Regulation. Section 4 gives the competent authorities the right, despite secrecy provisions, to obtain the information, clarifications and documents they need from a provider of an intermediary service about a suspected breach.

Section 4 requires the provider to hand the information over without undue delay, in the form the authority requests, and free of charge. Section 13 lets the competent authority attach a conditional fine to a supervision decision or other order, which for a provider runs per day and may not exceed 5 percent of the provider's average daily worldwide turnover or income in the financial year before the decision.

Section 14 lets Traficom impose a penalty payment on a provider of an intermediary service that intentionally or negligently breaches the duty in Article 11 of the Regulation to designate a single point of contact for authorities, the duty in Article 12 to designate an electronic point of contact for recipients, or the duties in Article 13 to name a legal representative.

Section 15 lets Traficom impose a penalty payment on a hosting service provider that intentionally or negligently breaches the duty in Article 16 of the Regulation to run a notice procedure for illegal content, to confirm receipt of a notice and to tell the notifier of its decision, the duty in Article 17 to give users a statement of reasons for restricting their content, or the duty in Article 18 to notify the police.

Section 16 lets Traficom impose a penalty payment on an online platform provider that intentionally or negligently breaches the duty in Article 20 of the Regulation to give recipients access to an internal complaint-handling system, and the further duties of online platforms that its points 2 to 6 list, including Articles 22, 24(3), 26, 27 and 28.

Section 18 caps a penalty payment on a provider of an intermediary service at 6 percent of its annual worldwide turnover in the financial year before the decision. The Act entered into force on 17 February 2024.

Section 1 says the Act concerns compensation for damage caused by a product to a person, and to property intended for private use or consumption that the injured person used mainly for that purpose. Section 1 defines a product as a movable thing, excluding a building on another person's land. Section 1 applies the provisions on products also to electricity. Section 1 defines a component as the raw material and part of a product and a substance used in making or producing it.

Section 2 excludes damage caused by the product to itself, damage caused to the product by a component connected to it before the product was put into circulation, and damage within the Nuclear Liability Act. Section 3 requires compensation for damage resulting from a product not being as safe as there was reason to expect.

Section 3 directs that the time the product was put into circulation, its foreseeable use, its marketing and instructions for use and other circumstances be taken into account. Section 4 treats damage arising from a component's lack of safety as caused by both the product and the component. Section 4 a puts on the injured person the burden of proving the damage, the lack of safety and the causal link between them.

Section 5 makes liable the person who manufactured or produced the product, the person who imported it into the European Economic Area to put it into circulation there, the person who brought it to be put into circulation from an EFTA state into the European Union, from the Union into an EFTA state or from one EFTA state into another, and the person who marketed it as his own under his name, trade mark or other distinguishing mark.

Section 5 does not apply the EFTA import rule to imports between states that ratified the Lugano Convention of 16 September 1988, in so far as a judgment for the injured person can be enforced on that ground against a person liable as producer, importer into the European Economic Area or own-brander.

Section 6 makes each person who put the product into circulation liable as the producer where the product does not show its producer, unless he names the liable person or the person who offered him the product within a reasonable time of a request. Section 6 applies the same rule to an imported product even where the product shows a person liable as producer or own-brander, unless it shows an importer within the meaning of section 5.

Section 7 releases the person claimed against from liability under sections 5 and 6 if he shows that he did not put the product into circulation in the course of business, or that the lack of safety results from the product having to comply with mandatory rules issued by an authority. Section 7 also releases that person if he makes it probable that the product had no lack of safety causing the damage when he put it into circulation.

Section 7 releases the maker of a component who shows that the lack of safety results from the design of the product into which the component was connected or from instructions of the manufacturer who ordered the product. The Government's bill states that the Act in force contains no ground of exemption based on the development risk. Section 8 provides that compensation under the Act is determined by applying the Tort Liability Act as far as appropriate.

Section 8 provides that there is no liability under the Act for property damage below 2,350 markka. Section 9 requires a claim to be brought within three years of the claimant learning, or having reason to learn, of the damage, the lack of safety and the person liable. Section 9 requires a claim to be brought within ten years of the liable person putting the product into circulation.

Section 10 makes void a contract term made before the damage appears that limits the injured person's right to compensation under the Act. Section 11 states that the Act does not limit the injured person's right to compensation on the basis of a contract, the Tort Liability Act or another law. Section 13 obliges the person who imported the product into Finland to help the injured person translate the claim into a foreign language.

Section 14 provides that the Act enters into force on 1 September 1991. Section 14 makes liable under the Act the person who put the damaging product into circulation after its entry into force. The Government's bill states that the Act entered into force with content almost in line with the 1985 directive. The consolidated text records its latest amendment, Act 468/2016, as in force from 1 January 2017.

The Government's bill would extend the definition of a product to include, besides electricity, raw materials, digital manufacturing files and software. Under the bill the provisions in force when it takes effect continue to apply to products placed on the market or put into use before then.

Section 2 provides that a digital service means a website or a mobile application and the functionalities related to them. Section 2 provides that a mobile application means application software designed and developed for use by the public on mobile devices such as smartphones and tablets. Section 2 provides that a provider means an authority, a public-law body, and an enterprise, foundation, association or other entity to whose digital services the Act applies.

Section 3 applies the Act to the identification services of identification service providers entered in the register under section 12 of the Act on Strong Electronic Identification and Electronic Trust Services (617/2009). Section 3 applies the Act to the parts of digital services used through the online payment aggregation and administration service of the Act on Common Administrative e-Service Support Services (571/2016) through which payment orders can be handled.

Section 3 applies the Act to the digital services of entities operating under special or exclusive rights granted by an authority within section 5 of the Act on Procurement and Concession Contracts of Entities Operating in the Water, Energy, Transport and Postal Services Sectors (1398/2016), in so far as they are intended to provide a service in those sectors to the public.

Section 3 applies the Act to the digital services of credit institutions, payment institutions, investment firms, insurance companies and insurance associations, in so far as they are intended to provide a service to the public.

Section 3 excludes workplace intranets and extranets, certain teaching sites and applications, public broadcasters' services other than audiovisual access services, live time-based media, maps and map services, content the provider did not produce, finance or control, and cultural heritage items that cannot be made accessible.

Section 7 requires a provider to ensure the perceivability and understandability of the content of its digital services and the operability and robustness of its interfaces and navigation, in accordance with the accessibility requirements. Section 7 provides that the accessibility requirements are defined in the references to harmonized standards, or parts of them, that the European Commission publishes in the Official Journal of the European Union.

The accessibility requirements website that the supervisory authority operates states that the Act obliges compliance with the Level A and Level AA criteria of WCAG 2.1. Section 7 requires the content of a digital service to meet the accessibility requirements when it is available to the users of the service. Section 7 requires pre-recorded time-based media published in a digital service intended for the public to meet the requirements within 14 days of its first or repeated publication.

Section 7 requires a provider to take account of the accessibility requirements in its procurement, as the procurement acts provide, where procurement law applies to its activity. Section 8 lets a provider depart from the accessibility requirements only if a prior accessibility assessment shows that meeting them would impose a disproportionate burden on its activities.

In assessing the burden, section 8 requires account to be taken of the needs of disabled people and of the provider's size, financial position, and the nature and scale of its operations.

Section 9 requires a provider to maintain an accessibility statement with at least an account of the content that does not meet the requirements and the reasons for departing, instructions for getting the information in an alternative way, an electronic contact for accessibility feedback, and a link to the supervisory authority's website for an accessibility complaint or request for clarification.

Section 9 requires the statement to be kept in the format set by the European Commission's implementing act under Article 7(2) of Directive (EU) 2016/2102. Section 9 requires the provider to keep the statement easily available on its website in an accessible form. Section 9 requires the statement of a mobile application to be in an accessible form and available on the provider's website or when the application is downloaded.

Section 10 gives everyone the right to send feedback to the provider's electronic contact about departures from the accessibility requirements, or to ask for clarification of the disproportionate-burden grounds. Section 10 gives a user who needs inaccessible content to establish or exercise interests, rights or obligations the right, for a justified reason in an individual case, to get it in an accessible form or in another accessible way.

Section 10 requires the request for content in an accessible form to be made to the electronic contact in the accessibility statement or to another published alternative contact. Section 10 requires the provider to send an electronic acknowledgement of receipt of feedback and to answer feedback and requests without delay and within two weeks of the contact.

Section 10 lets the provider extend the response time by up to two weeks where a request for content in an accessible form concerns a wide range of content, and requires the requester to be told. Section 10 requires the provider that does not give the requested content in an accessible form to draw up a written reasoned certificate for the requester.

Section 11 gives everyone the right to make an accessibility complaint to the supervisory authority about a provider that has not complied with the requirements and duties of chapter 3. Section 11 lets a user make an accessibility clarification request to the supervisory authority where the provider has given or failed to give the certificate under section 10(4), or has not answered a request for content in the manner or within the time section 10(3) sets.

Section 12 designates the Finnish Transport and Communications Agency (Traficom) as the supervisory authority that supervises compliance with the duties and requirements of chapter 3. Act 606/2024, which entered into force on 1 January 2025, transferred the matters under section 12 then pending at the Regional State Administrative Agency for Southern Finland to the agency.

Section 12 lets the supervisory authority order a provider to bring a digital service into line with chapter 3 within a reasonable time. Section 12 lets the supervisory authority order a provider, on an accessibility clarification request, to give the user within a set time the content of the digital service the user needs in an accessible form or in another accessible way.

Section 13 gives the supervisory authority the right to obtain, free of charge and notwithstanding secrecy provisions, the information and explanations it needs, and to order an inspection on the provider's premises other than premises used for permanent residence. Section 13 requires the provider, on request, to give the supervisory authority the access rights needed to extend an inspection to digital services whose use is restricted online.

Section 14 lets the supervisory authority back an order under section 12(3), and the exercise of its rights to information and inspection, with a conditional fine, which the Act on Conditional Fines (1113/1990) governs. Section 15 allows rectification to be demanded of the supervisory authority's decision on an accessibility clarification request and of an order made under section 12(3). Section 17 applies chapter 3 from 23 September 2019 to websites published on or after 23 September 2018.

Section 17 applies chapter 3 from 23 September 2020 to websites published before 23 September 2018. Section 17 applies chapter 3 to mobile applications from 23 June 2021. Section 17 applies the Act to pre-recorded time-based media from 23 September 2020. Section 17 applies the Act from 1 January 2021 to the digital services in section 3(1), paragraphs 5 and 6.

Section 17 excludes website and mobile application content archived before 23 September 2019, unless an authority needs it to deal with a pending matter. Section 17 applies chapter 3 to office-software file formats in digital services that were published on or after 23 September 2018. Section 17 applies chapter 3 to office-software file formats published before 23 September 2018 only where they are needed to establish or exercise a party's interests, rights or obligations.

Section 150(4) requires a passenger-transport license holder that provides air, rail, maritime, inland waterway and bus transport services other than those under the EU passenger rights regulations, and a provider of a brokering service and of a combining service, to see to it that the passenger has available in electronic form at least information on the services available to passengers with functional limitations and their assistance, on the accessibility of the fleet, and on the equipment that eases boarding and interaction with the driver.

Section 2 defines the EU passenger rights regulations as Regulation (EC) No 1107/2006 on the rights of disabled persons and persons with reduced mobility when travelling by air, Regulation (EU) 2021/782 on rail passengers' rights and obligations, Regulation (EU) No 1177/2010 on passenger rights in maritime and inland waterway transport and Regulation (EU) No 181/2011 on passenger rights in bus and coach transport.

Section 2 defines a brokering service as the brokering of transport for payment, excluding a service that brokers only the provider's own transport and package travel and linked travel arrangements within the Package Travel Act (901/2017). Section 2 defines a combining service as the formation of journey chains and other service packages for payment by combining the mobility services of different providers, excluding package travel and linked travel arrangements within the Package Travel Act.

Section 150(2) provides that a passenger-transport license holder need not supply the information in electronic form where that is neither appropriate nor reasonable because of the small size or area of operation of the undertaking, and that the information must then be publicly available in writing. Act 107/2023 amended section 150 and added section 150 a. Act 107/2023 entered into force on 1 February 2023 and applies from 28 June 2025.

Section 255 lets the Finnish Transport and Communications Agency order a person who breaks the Act to correct the breach and back the order with a conditional fine, a threat of discontinuing the activity in whole or in part, or a threat that the omitted measure is carried out at the person's expense. Section 242 lets the agency change, restrict or revoke a license where the license holder has repeatedly or seriously broken the Act and a remark or warning cannot be considered sufficient.

Section 242 allows the agency to revoke a license only if a lesser sanction cannot be considered sufficient. Section 186 makes the agency competent to handle passengers' complaints about breaches of chapter 17, except where the Consumer Disputes Board is competent to give a recommendation.

Section 1 of the Act requires the state and municipal authorities and the other contracting authorities named in section 5 to tender their procurements as the Act provides. Section 26 applies chapters 1 to 10 and 14 to 16 of the Act to procurements of at least the EU thresholds. Section 71 forms part of chapter 9 of the Act on the preparation of procurement, the invitation to tender and the description of the procurement object.

Section 99 applies chapter 11 of the Act, in addition to Parts I and IV, to goods, services and works procurements below the EU thresholds that reach the national thresholds. Section 71(1) requires a procurement object intended for natural persons to be defined, save in duly justified cases, so as to take account of accessibility for disabled users and design for all users.

Section 71(1) requires the procurement object to be defined by reference to the accessibility requirements that other legislation or an act of the European Union makes mandatory. Section 71(1) requires the definitions of the procurement object to give tenderers equal opportunities to take part and not to restrict competition in public procurement without justification.

Section 71(2) requires the definitions of the procurement object to be drawn up from performance or functional requirements, by reference to standards and other technical definitions each marked "or equivalent", or by a combination of the two. Section 71(3) bars a definition of the procurement object that names a particular manufacturer or origin, or refers to a trade mark, patent, product type or specific method, in a way that favors or disadvantages particular tenderers.

Section 71(3) allows such a reference only exceptionally, where the object of the contract cannot otherwise be described precisely and clearly, and then with the words "or equivalent". Section 90(2) lets the contracting authority ask a candidate or tenderer for a statement of its quality-assurance measures.

Section 90(2) requires a contracting authority that demands certificates from independent bodies that a candidate or tenderer meets quality-assurance standards, including accessibility for disabled persons, to refer to quality-assurance systems based on the European standard series.

Section 90(2) requires the contracting authority also to accept equivalent certificates from bodies in other member states of the European Union and certificates of equivalent quality-assurance measures that candidates and tenderers submit.

Section 90(3) requires the contracting authority to accept other evidence of quality-assurance measures where the candidate or tenderer could demonstrably not obtain the certificates within the time set, for reasons that are not its own, and shows that the measures correspond to the requirements of the quality-assurance standards.

Section 93(2) lets the contracting authority set price-quality comparison criteria on quality, which may include accessibility and design for the requirements of all users.

Section 93(4) requires the contracting authority to state its comparison criteria and their relative weighting in the contract notice, the invitation to tender or the invitation to negotiate, allows the weighting to be given as a reasonable range, and requires the criteria to be listed in descending order of importance where the weighting cannot be determined for an objective reason.

Section 93(5) requires the comparison criteria to relate to the subject matter of the procurement, to leave the contracting authority no unrestricted freedom of choice and to be non-discriminatory. Section 139 gives the supervision of compliance with the Act to the Competition and Consumer Authority.

Section 154 lets the Market Court, where a procurement breaches the Act, annul the contracting authority's decision, forbid it to apply an erroneous term in a procurement document, order it to correct its procedure, order it to pay a compensation payment, declare the contract ineffective, order it to pay a penalty payment to the State and shorten the contract term.

Section 154 allows the ineffectiveness remedy, the penalty payment and the shortening of the contract term only for procurements above the thresholds the section names. Section 154 allows those remedies only if the unlawful procedure has affected the outcome of the procurement or the position of a party. Section 155 limits the compensation payment, without a special reason, to ten percent of the value of the procurement contract. Section 158 limits the penalty payment to ten percent of the value of the procurement contract or concession contract.

Section 1 of the Act requires the state and municipal authorities and the other contracting entities named in section 5 that operate in water and energy supply, transport and postal services to tender their procurements as the Act provides. Section 13 sets the thresholds of the Act and provides that the Act does not apply to procurements below them.

Section 75 forms part of chapter 8 of the Act on the preparation of procurement, the invitation to tender and the description of the procurement object. Section 98 applies chapter 10 of the Act, in addition to Parts I and IV, to procurements of the services listed in Annex C that reach the thresholds of section 13.

Section 75(1) requires the definition of a procurement object intended for natural persons to take account of accessibility for disabled users and design for all users, save in duly justified cases. Section 75(1) requires the procurement object to be defined by reference to the accessibility requirements that other legislation or an act of the European Union makes mandatory.

Section 75(1) requires the definitions of the procurement object to give tenderers equal opportunities to take part and not to restrict competition in public procurement without justification. Section 75(2) requires the definitions of the procurement object to be drawn up from performance or functional requirements, by reference to standards and other technical definitions each marked "or equivalent", or by a combination of the two.

Section 75(3) bars a definition of the procurement object that names a particular manufacturer or origin, or refers to a trade mark, patent, product type or specific method, in a way that favors or disadvantages particular tenderers. Section 75(3) allows such a reference only exceptionally, where the object of the contract cannot otherwise be described precisely and clearly, and then with the words "or equivalent".

Section 88(2) lets the contracting entity ask a candidate or tenderer for a statement of its quality-assurance measures. Section 88(2) requires a contracting entity that demands certificates from independent bodies that a candidate or tenderer meets quality-assurance standards, including accessibility for disabled persons, to refer to quality-assurance systems based on the European standard series.

Section 88(2) requires the contracting entity also to accept equivalent certificates from bodies in other member states of the European Union and certificates of equivalent quality-assurance measures that tenderers submit.

Section 88(3) requires the contracting entity to accept other evidence of quality-assurance measures where the candidate or tenderer could demonstrably not obtain the certificates within the time set, for reasons that are not its own, and shows that the measures correspond to the requirements of the quality-assurance standards. Section 91(2) lets the contracting entity set price-quality comparison criteria on quality, which may include accessibility and design for the requirements of all users.

Section 91(4) requires the contracting entity to state its comparison criteria and their relative weighting in the contract notice, the invitation to tender or the invitation to negotiate, allows the weighting to be given as a reasonable range, and requires the criteria to be listed in descending order of importance where the weighting cannot be determined for a justified reason.

Section 91(5) requires the comparison criteria to relate to the subject matter of the procurement, to leave the contracting entity no unrestricted freedom of choice and to be non-discriminatory. Section 128 applies the chapter of the Public Procurement Act on legal remedies to appeals against decisions made under the Act and to the sanctions imposed for unlawful procedure.

Section 127 applies the supervision chapter of the Public Procurement Act to the supervision of procurements and to the powers of the Competition and Consumer Authority.

Section 7 a of the Kuvaohjelmalaki requires a video-sharing platform provider to take appropriate measures to protect children from programmes that may be harmful to a child's development. The measures must be proportionate to the nature of the programmes and the harm they may cause, taking into account the size of the video-sharing platform service and the nature of the service offered. The measures may not lead to prior checking of content or to filtering of uploads.

The Act applies to a video-sharing platform whose provider is treated as established in Finland under section 226 b of the Act on Electronic Communications Services. The National Audiovisual Institute may call on a video-sharing platform provider that neglects section 7 a to fulfil its duty and may back the call with a conditional fine. Act 1209/2020 inserted section 7 a and took effect on 1 January 2021.

Section 5 lets a provider offer an audiovisual programme only if it carries a clearly visible age-limit and content mark under Section 16, or, for a programme unambiguously intended only for those 18 and older, a clear mark of the 18-year age limit alone. Section 16 requires a programme harmful to a child's development to be classified 7, 12, 16, or 18 years with a content symbol, and lets a programme intended solely for adults skip classification if it instead carries the 18-year mark.

Section 6 prohibits offering a programme rated 18 to a minor at all, subject to a broadcast-timing exception. The same section requires the provider to keep a programme rated 7, 12, or 16 from being watched by a younger child through broadcast timing, making a blocking service available, or otherwise verifying age when the programme is offered. The National Audiovisual Institute supervises compliance and maintains the public register of classified programmes under Sections 17 and 18.

Section 50 gives the publisher of a press publication the exclusive right to determine over its publication by reproducing copies of it and communicating it to the public for a commercial purpose, in a way that lets a member of the public access it from a place and at a time individually chosen by them. The right does not apply to an individual user's private or non-commercial use of the press publication, a hyperlink, or an individual word or a very short extract of the press publication.

A press publication is defined as a collection composed mainly of journalistic literary works, not published for a scientific or academic purpose, that forms a separate periodically appearing or regularly updated issue under one title, aims to inform the public about news or other subjects, and is disseminated to the public by any medium at the publisher's initiative, editorial responsibility, and control.

The right lasts until two years have passed from the end of the year the press publication was published. It does not apply to a press publication first published before 6 June 2019. It leaves the author's own right in a work included in the publication untouched, and the author of such a work has a right to an appropriate share of the publisher's income from exercising the publisher's right.